Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
c116407e973cba29871411c66b21a75b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c116407e973cba29871411c66b21a75b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c116407e973cba29871411c66b21a75b_JaffaCakes118.html
-
Size
162KB
-
MD5
c116407e973cba29871411c66b21a75b
-
SHA1
2fe25f10c5702e8e108398fb70cae35c0456c3f1
-
SHA256
66907d719ece0a79bea0966ac0b67137213f89aef2500eec9477efc4f391c1a7
-
SHA512
a77e50a340c115084d20da0fd9f3b87a4b93063d3267941d8283630ba64f9a7d5c9ec8d70f7ad8e50308cb0152cba7759928d830c41af181853b5781d92d6efe
-
SSDEEP
1536:S0/CnyCG/eeeeeeeneeeeeee0eeeeeeeeo/TFSS+vemNeAeXHmn8qLujUebD+e/V:SaU0cVwTH1WfD5BgD5BVpWdW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1868 msedge.exe 1868 msedge.exe 5056 msedge.exe 5056 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 1116 5056 msedge.exe 84 PID 5056 wrote to memory of 1116 5056 msedge.exe 84 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1216 5056 msedge.exe 85 PID 5056 wrote to memory of 1868 5056 msedge.exe 86 PID 5056 wrote to memory of 1868 5056 msedge.exe 86 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87 PID 5056 wrote to memory of 1392 5056 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c116407e973cba29871411c66b21a75b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0xdc,0x7ffeebe946f8,0x7ffeebe94708,0x7ffeebe947182⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3487516537035752423,824904772649037267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,3487516537035752423,824904772649037267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,3487516537035752423,824904772649037267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3487516537035752423,824904772649037267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3487516537035752423,824904772649037267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3487516537035752423,824904772649037267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3487516537035752423,824904772649037267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3487516537035752423,824904772649037267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3880
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4876
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4480
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5111c361619c017b5d09a13a56938bd54
SHA1e02b363a8ceb95751623f25025a9299a2c931e07
SHA256d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
SHA512fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
-
Filesize
152B
MD5983cbc1f706a155d63496ebc4d66515e
SHA1223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA256cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
SHA512d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
-
Filesize
32KB
MD518498918cdc6cc1ebf10f758ce58c4d4
SHA13611ee09865788666944bbafe0ef23ef59c8c3dc
SHA25695b031d8acedc217e97ebec00988dbdc2fa33c89b4881a8c5afc761f47349243
SHA512457f8166a0677dbf0cbb109f28d01f21191675eb1a1aae204d3cc65b2924ac2157848bd29c58848e5d0924d3e0409f0e51b93024d7c97ec4004b9d870e4b1920
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD5acfefb3dbc92dfb36771615b1f2459c9
SHA14c0f65a88542d8cce09441fcfc76d0652d0572d5
SHA256215e50462c85c8f46b12e9fc014c5a50065dc6dbe6f2b921565695e190eed781
SHA512d8ce98d2eabb042c2d917057990bfcbb887f5dd910169b2b1bd299c936136c0f0b326ae375c409b016e697a2c78304fd3e9337a10ccc04eaa1b51aa7412441f0
-
Filesize
3KB
MD5922aea58543aca87f4a1a6e7fc65b384
SHA1c814c762645c783422c3c338491b3618b93b7146
SHA2566b4008f5978ac9ac4022477797ddfbca010191e91915d30cc66fb810bb3cfba5
SHA51250e2d2ea004e24232963f1a998ea4cb3009c1b0c9e2f43cdc1fcd1c06ba93dd6691cfc6ed68e62786fb377a44a623293734ea8d099948d7e14fa2fd40e1d22cf
-
Filesize
3KB
MD5ef6b795293b0464a9d583955bf85b6a7
SHA1b5ce3274da2000cfdc2caae63147bad1603f23cc
SHA256dccb7543367b74d4ba381e3f2196706d3f12be1b886e14a997f919de32d236ef
SHA5128e6af0f6d0face33ed500459c44989de5f206c8c17cd6b025475ccc4210f2c45886e9664ffccc7143e4593d26cc32c0934f7c903ca4cb7badfcf543d249e479d
-
Filesize
7KB
MD52861fd96109a26de4d4c1d3942afd0d4
SHA1487645e8087492564818a334e9ef53b50d624456
SHA256b4e86430171c659b1cda23954e93633ccefbb5344cedfd015eae97fe2b1f0ddb
SHA512d1a24fcd3322ae60c7865af9a7d1055969ed16ec83437a391efffdf429ad4ab39682b585aa0a38777a33b2fe33bf02f309e68705c67d4c63ae9effa2faf2da20
-
Filesize
5KB
MD5044b9845d65db55d6d2780342dacc849
SHA16c992a9ddaa280acbffe1243bafac18863ff760e
SHA2560a2f1b815171ecc0d95e25ecb5c759fd39b9d68d42b99348ec692f219f612270
SHA512417e9723c05191383c85c9320655a85d577a0e8a41086ff333a410cded7b812ee4e31997b10f128bb8db63c2ed4616d26b05a9fb0749d5fc3c4f9bddfe71f1e1
-
Filesize
10KB
MD56a664044cc25348022eef20800cc34b4
SHA1ed8b09853d5fb452197b869467d32ba70c99c012
SHA256e968c6dd1f31ca2328e2670bebf1bcce3b1d12f421792c64473191f0ff79b332
SHA512c54bdd95717fee90dd9356b33c4d9488af73ab610ed0c84aceb226fe6efb66c9a7d4864ed59691ed7a68a34bd4a66cf78990d6072a3ef870cc6b04354cc7cc1f